Saturday 7 July 2007

LifeDrive necromancy

I've just had some success in bringing my poor LifeDrive back from the grave. While the HDD is still unusable due to a broken cable, I was able to get the Linux kernel to boot. I chopped the end off a Nokia DKU-5 data cable (USB -> TTL serial converter) and soldered it to some test points corresponding to the serial port on the LD's mainboard. You might be able to make out the tiny red wires in bottom-left corner of the photo. (The yellow stuff is Blu Tack, preventing things from moving around). By holding down the hotsync button and resetting the device, minicom at 115200 baud and no flow control on my PC gets me to the "Sandal" recovery console:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  Sandal
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
>
There are a couple of different commands you can use in the Sandal console but the important ones are "w" which reads and writes memory and "x" which executes code at the given address. I wrote a small script bin2sandal.py which converts a binary image into a series of Sandal commands enabling you to upload and execute a tiny bootloader I wrote in ARM assembly called quickload:
$ ./bin2sandal.py -d quickload.bin > /dev/ttyUSB0
...
>w 0xa00000e8=0xe5950000                                                                                                                                                              
0xA00000E8 : 0xE5950000                                                                                                                                                               
>w 0xa00000ec=0xe1a0f00e                                                                                                                                                              
0xA00000EC : 0xE1A0F00E                                                                                                                                                               
>x 0xa0000000                                                                                                                                                                         
Executing at 0xA0000000                                                                                                                                                               
Q?
The Q? prompt is quickload asking us to upload a kernel image. Well we'd better give it what it wants:
$ ./ql.py < zImage > /dev/ttyUSB0
Q?
  ql.py: uploading image...                                                                                                                                                           
G.............................

A little while later:
.............................D
Uncompressing Linux..........................................
........................... done, booting the kernel.                                                                                           
Linux version 2.6.21-hnd2 (ato@shion) (gcc version 4.1.2) 
#38 Sat Jul 7 12:50:15 EST 2007                                                                                   
CPU: XScale-PXA270 [69054117] revision 7 (ARMv5TE), cr=0000397f                                                                                                                       
Machine: Palm LifeDrive
... boot messages ...
# echo "I'm alive!"
I'm alive!                                                                                                                           
#
Unfortunately neither LCD nor MMC is working. I suspect this is because we normally rely on Palm OS to configure and power them up. I'll try overwriting the GPIO configuration with that from a working device later. The tools I used are in linux4palm/tools/serial-loader in Hack&Dev's SVN. Quickload should work on any PXA device, however you'll need to change the machine code that's passed to the kernel.

3 comments:

pfalcon said...

Really clever hack, I enjoyed reading this. And will need to look at quickload.

Unknown said...

Of course mmc and the lcd screen won't work, you need to set the gpio's to the correct direction and alternate function.

It would be nice if you could make some documentation about how to setup the device from scratch, with all gpios etc.

BTW, which end of the nokia cable is the usb to serial converter in?

Alex said...

scott: Yep later I got the LCD working just by copying GPLR, GPDR etc from a live device. There seems to be several plain output GPIOs that control power to the LCD and backlight I haven't gone to the trouble of figuring out which is which though.

Adding some pxa_gpio_mode() calls to palmld_init to setup the alternate function and directions of the MMC GPIOs.

In the nokia cable I have, the usb -> serial chip is in the USB connector. When I was hunting for one on ebay I specifically got one that had a "big" USB connector rather than a "big" phone connector in the hope the chip would be in the USB end. This is so I could just chop off the phone connector instead of messing around cracking open the connector or trying to solder onto it.